fix rive_common dependency
What the developer wrote
Authored by Robert Malikowski
fix rive_common dependency
What changed, and why it matters
This commit changes the source of a software dependency called rive_common from one GitHub account (MrCyjaneK) to another (malik1004x). Dependencies are external code packages the app relies on. Switching to a different, unverified source could introduce malicious or vulnerable code into the wallet app, but the commit itself does not show any harmful code—only the source change. There is no vendor explanation or security disclosure provided.
Treat this change as a supply-chain risk until verified. Review the new repository at https://github.com/malik1004x/rive_common ref 34ef174e87dc4a29e728babfaad8dd9464b704ae for malicious modifications compared to the original upstream and the prior fork. Confirm the new fork is controlled by a trusted maintainer, pin the ref, verify checksums, and document the reason for the switch in the repository. Consider requiring code-owner approval for dependency-source changes.
Security signals we found
Dependency source changed to a different GitHub account without documented rationale
No commit message detail explaining why the original source was unsuitable
No checksum or provenance verification shown in the diff
Wallet application context increases sensitivity of supply-chain changes
Evidence from the diff
The diff updates pubspec_overrides.yaml to point the rive_common Flutter dependency override to a different Git repository and commit hash. The original source was https://github.com/MrCyjaneK/rive_common at ref 9457422fce3f1524437f6a1429200f048931a2fe; it is now https://github.com/malik1004x/rive_common at ref 34ef174e87dc4a29e728babfaad8dd9464b704ae. No justification, verification, or security assessment is included in the commit message or supplied references. This is a supply-chain-relevant change because it alters where build tooling fetches a compiled dependency.
Changed components
pubspec_overrides.yamlrive_common dependency overrideInspect captured patch +2 / −2
diff --git a/pubspec_overrides.yaml b/pubspec_overrides.yaml
index 94a1cf6c..b3b236a4 100644
--- a/pubspec_overrides.yaml
+++ b/pubspec_overrides.yaml
@@ -1224,8 +1224,8 @@ dependency_overrides:
ref: 2dbfe918a3d38340f378ab2734b1c97ebcb4ab26
rive_common:
git:
- url: https://github.com/MrCyjaneK/rive_common
- ref: 9457422fce3f1524437f6a1429200f048931a2fe
+ url: https://github.com/malik1004x/rive_common
+ ref: 34ef174e87dc4a29e728babfaad8dd9464b704ae
riverpod:
git:
url: https://github.com/rrousselGit/riverpod
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.